CVE-2026-93763

A protection mechanism failure in the object-document mapper's encryption configuration generation can cause fields that an application declared for client-side field-level encryption to be written and kept in cleartext, without any error or warning. A party holding ordinary read access to the database can then read values that were intended to be protected from that party. This may result in unintended disclosure of sensitive information.

• CWE-312

• https://jira.mongodb.org/browse/MONGOID-5984

Published

Sep 18, 2026

Last Modified

Sep 18, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-93758An insecure direct object reference in the nested attributes…8.1
• CVE-2026-93759Mongoid does not neutralize a string-typed query criterion s…8.6
• CVE-2026-9376A vulnerability was determined in JPress up to 1.0.3. The af…6.3
• CVE-2026-93760Mongoid does not restrict which query operators may come fro…8.2
• CVE-2026-93761An inefficient regular expression complexity issue in the in…7.5
• CVE-2026-93762Mongoid contains an unsafe reflection weakness in the query …9.8
• CVE-2026-93764Mongoid may omit encryption rules for fields declared on emb…6.5
• CVE-2026-93765Mongoid contains an unsafe reflection weakness in the docume…9.1
• CVE-2026-9377A vulnerability was identified in SourceCodester SUP Online …2.4
• CVE-2026-9378A security flaw has been discovered in Edimax BR-6675nD 1.12…6.3
• CVE-2026-9379A weakness has been identified in Edimax BR-6675nD 1.12. Thi…6.3
• CVE-2026-9380A security vulnerability has been detected in Edimax BR-6675…8.8